Q1 Does the draft guidance cover the relevant issues about the right 
of access? 


Yes 
No 
X  Unsure/don’t know 


If no or unsure/don’t know, what other issues would you like to be 
covered in it? 


The draft guidance does cover the relevant issues about the right of access for 
organisations aspiring to be compliant with GDPR. Justice for Punters (J4P) has 
substantial volumes of evidence of organisations within the gambling sector that 
appear to view SARs as an inconvenience, to be dealt with within their own 
timescales, making unnecessary requests to delay the process in the hope the 
subject will drop the matter. 


Examples include: 

e Requesting evidence of identity on receipt of a SAR submitted online despite 
a customer recently transacting and no change of contact details. Then 
proceeded to reject clear and accurate ID documents to delay matters even 
further. 

Insisting a SAR is submitted on a company designed form before action is 
commenced. 

Repeatedly failing to reply to correspondence. 

Repeatedly failing to provide all data held. 

Erroneously citing ‘the prevention or detection of crime’ as a reason for not 
fulfilling a SAR. 

Gambling companies ‘playing off’ customers by insisiting others are data 
controllers for the information being requested 


Much more emphasis should be placed on compliance being a legal requirement 
and the potential penalties available to the ICO in the event of persistent non 
compliance. 


Q2 Does the draft guidance contain the right level ofdetail? 


Yes 
No 


X  Unsure/don’t know 


If no or unsure/don't know, in what areas should there be more detail 
within the draft guidance? 


Same comments as Q1 apply. In the vast majority of instances the guidance 
explains clearly what action an organisation should take on receipt of a SAR, 
within what timescales and in what circumstances an extension to the timetable 
could apply. The current reality is that a significant number of gambling 


companies don’t follow this clear guidance, make things up for their convenience 
as they go along and hope nobody holds them to task (which at present is the 
case). 


Q3 Does the draft guidance contain enough examples? 


X Yes 
No 


Unsure/don’t know 


If no or unsure/don’t know, please provide any examples that you 
think should be included in the draft guidance 


Q4 We have found that data protection professionals often struggle with applying and 
defining‘manifestly unfounded or excessive’ subject access requests. We would like to 
include a wide range of examples from a variety of sectors to help you. Please provide 
some examples of manifestly unfounded and excessive requests below (if applicable). 


Not applicable. 


Q5 On a scale of 1-5 how useful is the draftguidance? 


1 - Not at all 2 - Slightly 3 - Moderately 4 - Very useful 5 - Extremely 
useful useful useful useful 
O O X E 


Q6 Why have you given thisscore? 


The guidance is useful to compliant organisations but doesn’t place sufficient 
emphasis on potential penalties for non compliance. 


Q7 To what extent do you agree that the draft guidance is clear and easy tounderstand? 


Strongly Disagree Neither agree nor Agree Strongly agree 
disagree disagree 
E L] LJ X 


Q8 Please provide any further comments or suggestions you may have about the draft 
guidance. 


Once this guidance is issued it is our sincere hope that the ICO takes regulatory action 
against organisations who persistently and deliberately fail to comply with the law. 


Q9 Are you answeringas: 


O An individual acting in a private capacity (eg someone 
providing their views as a member of the public) 

O An individual acting in a professional capacity 

X On behalf of an organisation 

O Other 


Please specify the name of your organisation: 


Justice for Punters (J4P) 


What sector are you from: 


Voluntary 


Q10 How did you find out about thissurvey? 


ICO Twitter account 

ICO Facebook account 

ICO LinkedIn account 

ICO website 

ICO newsletter 

ICO staff member 

Colleague 

Personal/work Twitter account 
Personal/work Facebook account 
Personal/work LinkedIn account 
Other 


m 0- 0 00 0a 0 0A al 


Thank you for taking the time to complete the survey 


